METHOD, SYSTEM, AND NETWORK ELEMENT FOR MONITORING OF 
BOTH SESSION CONTENT AND SIGNALLING INFORMATION IN 
NETWORKS 

FIELD AND BACKGROUND OF THE INVENTION 

[0001] The present invention relates to a method, system, and network element or 
apparatus for performing lawful interception in e.g. an IP multimedia subsystem (IMS) 
of a network such as a UMTS, Universal Mobile Telecommunication System, 
network. In particular, the invention relates to a method and apparatus for monitoring 
of both session content and signalling information in networks of different types such 
as IP based networks and GPRS or UMTS based networks. 

[0002] Conventionally, Lawful interception of GPRS IRI (General Packet Radio 
Service, Interception Related Information) and GPRS CC (Content of 
Communication) may be activated using GPRS domain user identities (IMSI, 
MSISDN, and IMEI) as target criterion in GPRS Support Node(s). Call State Control 
Function(s), CSCF(s), cannot perform interception based on these triggers. Currently 
IMS IRI may be collected using separate IMS interception started with SIP URL or 
TEL URL (URL = Universal Resoxirce Locator) as a target criterion. 
[0003] WO 02/093838 discloses a method and communication system allowing 
interception of a connection of a target to be intercepted. Interception triggering 
information may be transmitted between the user plane and control plane. When a 
connection is to be intercepted, a control means handling signalling of the connection 
that generates interception information for informing a support element transmitting 
the traffic on an identification of the target to be intercepted. In response thereto, the 
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support element copies the traffic information to another network element for 
interception. 

SUMMARY OF THE INVENTION 

[0004] It is an object of the present invention to provide a method and apparatus by 
means of which Lawful Interception can be improved. 

[0005] This object is achieved by a method as defined in the independent method 
claims. 

[0006] Additionally, the above object is achieved by a system as defined in the 
independent system claims. 

[0007] Further, there is provided a network element as defined in the network element 
claims. 

[0008] Some advantageous implementation features are defined in the dependent 
claims. 

[0009] The invention provides monitoring of both session content (Content of 
Communications, CC, that is data transmitted between communicating parties) and 
signalling information in networks such as IMS networks based on one identity e.g. 
either in GPRS or any other IP connectivity network, or IMS level. 
[0010] According to an aspect of the invention, there are provided method and system 
for sending lawful interception information from an element or function of a network, 
such as a Call State Control Function, CSCF, to one or more elements or functions, for 
example GPRS Support Nodes, GSNs, of another network to activate also the 
monitoring of content of communication based on IMS level triggers. The content of 



communication can thus be intercepted based on IMS level identities (e.g. SIP URI 
defined in RFC 3261, TEL URI defined in RFC 2806 or general URI as in RFC 2396) 
and it is not necessary to use a separate GPRS level activation based on different 
GPRS level identities that the target might have (International Mobile Subscriber 
Identity, IMSI; Mobile Subscriber ISDN Number, MSISDN; International Mobile 
Equipment Identity, IMEI). 

[0011] With this invention it is possible for Law Enforcement Agencies, LEAs, to get 
also the content of session with only one identity, and, if desired, to map it together 
with IMS level IRI (IRI = Interception Related Information, such as Signalling 
Information fi-om Session Initiation Protocol, SIP, messages). 

[0012] This kind of solution is useful e.g. in a multi-vendor network where a GPRS 
backbone is from a different vendor than the IMS network. The invention is also 
directly applicable for other backbones such as 3GPP2 (3G Partnership Project 2) 
based IMS networks or WLANs, Wireless Local Area Networks. 
[0013] The invention further provides, according to another or additional aspect, a 
method for activating the IRI interception in the IMS domain based on GPRS domain 
triggering. Such a method solves the same problem as described above, but in reverse 
direction. With this method it is possible for the LEAs to get also the IMS IRI using 
only GPRS level identities (IMSI, MSISDN, IMEI). 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0014] In the following, the invention will be described in greater detail on the basis 
of a preferred embodiment with reference to the accompanying drawings. 



[0015] Fig. 1 shows an embodiment of a configuration for lawfiil interception in IMS 

networks, 

[0016] Fig. 2 shows a further embodiment of a configuration for lawful interception 
in IMS networks, 

[0017] Fig. 3 shows another embodiment of a configuration for lawful interception in 
IMS networks, 

[0018] Fig. 4 shows a flow diagram of signalling during media authorization 
according to an embodiment of the present invention, and 

[0019] Fig. 5 shows a flow diagram of signalling during media authorization 
according to another embodiment of the present invention. 

DESCRIPTION OF PREFERRED EMBODIMENTS 

[0020] The below described embodiments of the invention provide methods and 
systems or devices for monitoring session content in IP Multimedia Subsystem, IMS, 
core networks. Methods and systems are disclosed for carrying information for 
starting interception fi-om GSN to CSCF(s) where the IMS IRI is available. The 
decision of interception is preferably done for every session created in IMS. 
According to at least one of the preferred embodiments, a Call State Control Function, 
CSCF, of IMS sends Lawful Interception, LI, information either directly to a GPRS 
Support Node, GSN, to Administration Function, ADMF, or to Delivery Function 2, 
DF2. 

[0021] Fig. 1 shows an embodiment of the invention providing a reference 
configuration or architecture for lawful interception in IMS networks. Conventionally 



IMS LI and GPRS LI architectures were totally separated although they could use 
some same elements, that is, ADMF and DF2. 

[0022] The embodiment of Fig. 1 includes, or cooperates with, one or more Law 
Enforcement Monitoring Facilities, LEMFs, 1 which are connected or connectable to 
an Administration Function, ADMF, 3 via an interface HIl. ADMF 3 comprises a 
mediation function 2 and a mapping fimction 4. The ADMF 3 is connected or 
connectable to a Call State Control Function, CSCF, 11, and a GPRS Support Node, 
GSN, 12 via an interface Xl_l. The GSN 12 may e.g. be a Serving GPRS Support 
Node, SGSN, and/or Gateway GPRS Support Node, GGSN. 

[0023] The LEMFs 1 are further connected or connectable to a Delivery Function 2, 
DF2, 6 via an interface HI2. DF2 6 comprises a mediation function 5. The DF2 6 is 
connected or connectable to the Call State Control Function, CSCF, 11, and the GSN 
12 via an interface X2. 

[0024] The LEMFs 1 may further be connected or connectable to a Delivery Function 
3, DF3, 9 via an interface HI3. DF3 9 comprises a mediation function 8. The DF3 9 
is connected or connectable to the Call State Control Function, CSCF, 11, and the 
GSN 12 via an interface X3. 

[0025] The ADMF 3 is preferably connected or connectable to the DF2, 6 via an 
interface Xl_2. Further, the ADMF 3 is preferably connected or connectable to the 
DF3, 9 via an interface XI 3. 

[0026] The Administration Function, ADMF, is thus able to communicate with the 
Delivery Function 2, DF2, and/or the Delivery Function 3, DF3. 
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[0027] Fig. 2 shows a further embodiment of the invention providing a reference 
configuration or architecture for lawful interception in IMS networks. The 
embodiment of Fig. 2 is similar to the embodiment of Fig. 1 except that the DF2 6 
includes a mapping function 7. ADMF 3 does not include, in this embodiment, a 
mapping function 4. Apart from these changes, the above description of Fig. 1 also 
applies to the embodiment of Fig. 2. 

[0028] Fig. 3 shows another embodiment of the invention providing a reference 
configuration or architecture for lawful interception in IMS networks. The 
embodiment of Fig. 3 is similar to the embodiments of Fig. 1 and 2, except that the 
DF3 9 includes a mapping function 10. ADMF 3 does not include, in this 
embodiment, a mapping function 4. Apart from these changes, the above description 
of Fig. 1 also applies to the embodiment of Fig. 3. 

[0029] The CSCF 11 and the GSN 12 are connected or connectable to each other via 
an interface Go. 

[0030] According to Figs. 1 to 3, a Mapping Function 4, 7, 10 is provided for ADMF 
3, DF2 6, or DF3 10. In alternative embodiments, two or three of these Mapping 
Functions may be provided so that Mapping Functions are present in ADMF 3 and 
DF2 6, or in ADMF 3 and DF3 9, or in DF2 6 and DF3 9, or in ADMF 3, DF2 6, and 
DF3 9. 

[0031] When GPRS level interception is desired to be started from the indication at 
the IMS level (e.g. at the time of IMS session establishment), the information of 
matching triggers in IMS level has to be forwarded to General Packet Radio Service, 
GPRS, e.g. to GSN 12, by using identities that are known in GPRS, such as 



is- 

International Mobile Subscriber Identity, IMSI, or GPRS Charging Identifier, GCID + 
GGSN ID pair. If the ADMF 3 is included in the signalling path, it may command the 
GSN 12 to start the interception. LI information delivered from IMS, e.g. CSCF 1 1, to 
GPRS, e.g. GSN 12, may consist of IMS domain user identifiers, IMS domain session 
identifiers (ICID (IMS Charging Identifier), Call-ID, Authorization Token), GPRS 
domain user identifiers (IMSI, MSISDN, IMEI), GPRS domain session identifiers 
(GCID + GGSN ID pair, TID) (GCID = GPRS Charging Identifier; TID = Tunnel 
Identifier), and/or lawful interception parameters (LIID (Lawful Interception 
Identifier), Delivery Function addressing information, type of interception). By using 
at least one, or some or all of these, or other, identifiers GPRS may perform CC 
interception. Which identifiers are used may depend on the embodiments used. The 
invention offers several different embodiments for delivering an indication to start 
interception from the IMS domain to the GPRS domain. 

[0032] Session content exists in the GPRS level, but the interception triggers of the 
IMS networks are normally not visible in GPRS level, they are visible only in the IMS, 
e.g. in CSCFs of IMS. 

[0033] LI Triggers of the IMS networks defined so far are SIP_URL and/or 
TEL URL (URL = Universal Resource Locator). GPRS domain information 
(identities) associated with the LI triggers of the IMS, that can be used in interception 
in GPRS level may vary between sessions established in IMS. For example, the user 
in IMS may use different terminal than used in previous IMS session when starting a 
new IMS session. 
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[0034] Therefore the decision of interception is preferably done for every session 
created in IMS. If desired by the LEA, the decision of interception may remain after 
the appropriate session has been terminated in IMS. Thus, the decision of interception 
issued for a session created in the first network, e.g. IMS, is maintained in the first 
network after termination of this session for use for at least one following session. 
Hence, the decision of interception is used for at least two sessions, and there is no 
need to decide again on the question of interception for a new session. IMS domain 
session information intercepted with IMS domain triggers in IMS domain is preferably 
forwarded to GPRS so that GPRS can perform CC monitoring. The CSCF 1 1 of IMS 
may send LI information either directly to GSN 12 (e.g. Serving GPRS Support Node, 
SGSN, and/or Gateway GPRS Support Node, GGSN) over Go interface (TS 29.207 
V5.5.1), or to ADIVlF 3 over Xl_l interface, or to DF2 6 over X2 interface. 
[0035] Some embodiments of the invention also incorporate a reverse operation. A 
method and system for activating the IRI monitoring in IMS level may be employed 
when the interception is originally activated using GPRS domain target identifiers 
(IMSI, MSISDN, International Mobile Equipment Identity, IMEI). In this method and 
system, GPRS domain, e.g. GSN 12, examines the transmitted information to/from the 
intercepted target. The device that performs the data analysis can be either GSN 12 or 
Delivery Function 3, DF3, 9. When it is noticed that the data contains SIP header(s), 
the identities are preferably extracted from To and/or From fields of SIP header. 
[0036] If GSN 12 is performing the data examining, it sends LI information either 
directly to CSCF 1 1 over Go interface or to ADMF 3 over Xl_l interface. If DF3 9 is 
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performing the data analysis, it sends LI information either directly to CSCF 1 1 over 
X3 interface or to ADMF 3 over Xl_3 interface. 

[0037] When the ADMF 3 is included in the signalling path, it may explicitly 
command CSCF 1 1 to start the interception. LI information delivered from GPRS to 
IMS may consist of IMS domain user identifiers, IMS domain session identifiers 
(ICID, Call-ID, Authorization Token), GPRS domain user identifiers (IMSI, 
MSISDN, IMEI), GPRS domain session identifiers (GCID + GGSN ID pair, TID), 
and/or lawful interception parameters (LIID, Delivery Function addressing 
information, type of interception). 

[0038] Lawful interception of IMS IRI is always activated using IMS domain user 
identities as target criterion in Serving-CSCF, S-CSCF or in Proxy-CSCF, P-CSCF 
(SIP_IJRL and TEL_URL). GSN(s) cannot perform interception based on these target 
criterions. In accordance with embodiments of the invention, information indicating 
the need of LI activation can be carried from CSCF 1 1 to GSN(s) 12 where actual IMS 
session related content of communication is present. Thus IMS session related content 
of communication can be monitored. 

[0039] The invention offers several solutions how the indication to start interception 
may be delivered from IMS domain to GPRS domain. 

[0040] In the following, several embodiments are described which provide solutions 
with GPRS interception activation initiated by IMS based on LI download over Go 
interface Embodiment 1.). According to a first embodiment, LI information is sent 
from CSCF 1 1 (or more precisely a Policy Decision Function, PDF, of P-CSCF) to 
GSN 12 over Go-interface together. The indication to intercept is delivered from 



CSCF 11 (or PDF) to GSN 12 during the media authorization. The structure of this 
embodiment 1 .) and of all further embodiments may be in accordance with anyone of 
Figs. 1 to 3, or any arbitrary combination thereof, or a structure without a mapping 
function, unless otherwise stated below. 

[0041] Fig. 4 shows the signalling during media authorization. According to Fig. 4, a 
User Equipment, UE, 20, a SGSN 21, a GGSN 22, and a Proxy Call State Control 
Function, P-CSCF, 23 are provided. The P-CSCF 23 may correspond to, or be 
identical with, CSCF 11 of Figs. 1 to 3. The SGSN 21 or the GGSN 22 may 
correspond to, or be identical with, GSN 1 1 of Figs. 1 to 3. 

[0042] According to Fig. 4, a procedure 24 for starting a SIP session establishment is 
carried out. This "Start of the SIP session establishment procedure" 24 includes the 
conventional SIP messaging before media reservation. Subsequent to the procedure 
24, media reservation is carried out in accordance with messages 1. to 7., as shown in 
Fig. 4. In message 1., an Activate PDP Context Request is sent from UE 20 to SGSN 
21. The SGSN 21 delivers a message 2., Create PDP Context Request, to GGSN 22. 
The GGSN 22 sends a message 3., COPS REQ, to P-CSCF 23 which responds by 
sending a message 4., COPS DEC + LI (COPS = Common Open Policy Service 
Protocol; LI = Lawful Interception indication or parameter), to GGSN 22. The GGSN 
22 returns a message 5., COPS RPT, to P-CSCF 23, and sends a message 6., Create 
PDP Context Response + LI, to SGSN 21. In a step 7., the SGSN 21 transmits a 
message 7., Activate PDP Context Accept, to the UE 20. A subsequent procedure 25, 
"End of the SIP session establishment procedure", includes the conventional SIP 
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messaging after media reservation. The procedure of establishing the SIP Session is 
thus ended. 

[0043] The indication to intercept is delivered in the message 4., COPS DEC, 
(decision message of COPS, Common Open Policy Service Protocol) of Fig, 4. When 
the GGSN 22 asks for authorization of the PDP context, it receives the LI information 
with the authorization decision. This method is appropriate, and fits well to the 
purpose of Go interface. Thus adapting the Go interface because of the LI is easy. 
The LI information sent in the COPS DEC message preferably consists of IMS 
domain target criterion (e.g. SIP_URL or TEL_URL), LI parameters (e.g. LIID, DF3 
address and type of interception), and/or IMS domain session identifiers (e.g. ICID, 
Call-ID, or Authorization Token) or GPRS domain session identifiers (e.g. GCID + 
GGSN address pair or TID). 

[0044] When GGSN 22 receives this message it can start the interception of the 
content of communication related to the IMS session. It also has to deliver the 
information to SGSN 21. The GGSN 22 does this by attaching the LI information it 
received fi-om (PDF of) P-CSCF 23 to the Create PDP Context Response message 6. 
that is sent as a response to Create PDP Context Request message. The GGSN 22 
sends the Create PDP Context Response message to the SGSN 21, which in turn can 
start the interception of content of communication related to IMS session. 
[0045] Because the SGSN 21 of the monitored user may change due to inter-SGSN 
handover, the LI information is transferred to the new SGSN 21. During the inter- 
SGSN handover, the new SGSN requests active PDP contexts fi-om the old SGSN. 
The new SGSN sends old SGSN a SGSN Context Request message, and the old 
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SGSN responds with a SGSN Context Response message. Now, if there is an active 
IMS session related content of communication interception, the old SGSN attaches the 
LI information to the SGSN Context Response. In this way the new SGSN may start 
the interception of content of communication related to the monitored IMS session. In 
the case of inter-operator handover, the old SGSN may or may not send the LI 
information to the new SGSN. 

[0046] Embodiment 2.). In this solution, the ADMF 3 takes care of the actual 
interception activation in all the network elements over the Xl_l interfaces. It gives 
the CSCF(s) 11 and SGSNs/GGSNs 12 the same LI information. The LI information 
in this embodiment consists of the IMS domain target criterion (SIP_URL or 
TEL URL) and lawful interception parameters (LIID, DF2/DF3 address, type of 
interception). Because the GSN 12 cannot activate the interception using IMS domain 
target criterion, the interception is stored in GSN 12 in semi-active state. Like in the 
above described embodiment 1, the indication to intercept is delivered from the CSCF 
11 (PDF) to GSN 12 during the media authorization. The indication to intercept is 
delivered in COPS DEC message (message 4. of Fig. 4). A difference of this 
embodiment 2.) to the embodiment 1.) is that CSCF 1 1 (PDF) needs to include only an 
indication of the interception need in the authorization decision. This is because the 
other information is already present in the GSN 12 in the semi-active interception after 
the initial activation. LI information sent with COPS DEC message 4. may be the 
used IMS domain target criterion. In this embodiment, the ADMF 3 takes the 
responsibility of delivering and activating the LI in GSNs 12. 
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[0047] The LI indication is delivered from GGSN 22 to SGSN 21 in Create PDP 
Context Response message 6. like in embodiment 1. The LI information attached into 
the Create PDP Context Response message may be the used IMS domain target 
criterion. As with the GGSN 22 the other information is already present in the SGSN 
21 after the initial activation. 

[0048] Like in embodiment 1.), also in this embodiment 2.) the chance of inter-SGSN 
handover is considered. The method for delivering the LI indication between SGSNs 
is similar to that in the embodiment 1.). The LI information inserted into SGSN 
Context Response message consists of the same information that the old SGSN 
received in the Create PDP Context Response message from the GGSN. That is, for 
example the IMS domain target criterion. In the case of inter-operator handover, the 
old SGSN may send the LI information to the new SGSN. The fact that whether the 
interception is continued in the new operator's network or not, is decided by the 
independent activation done or not done in the new operator's network. 
[0049] Embodiment 3.). The embodiment 3.) provides a solution for activation of 
GPRS interception initiated by IMS in which DF2 holds the activation responsibility. 
[0050] In this embodiment 3.), the LI information is sent from CSCF 1 1 to DF2 6, or 
to the Mediation Function 5 of DF2 6, over the X2 interface. DF2 6 or the Mediation 
Function 5 of DF2 6 then sends the LI information to the GSN 12 over the X2 
interface. The LI information sent over the X2 interfaces may consist of IMS domain 
target criterion (SIP_URL or TEL_URL), IMS domain session identifiers (ICID, Call- 
ID, Authorisation Token), and/or GPRS domain session identifiers (GCID + GGSN 
address pair(s)). As X2, X3 interfaces are standardized, the embodiment complies 
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with current LI architecture, and simply adds a new directional data flow over X2 
interface, that is, the LI information sent from DF2 6 to GSN 12. 
[0051] The following embodiments 4.), 5.) provide an activation of GPRS 
interception initiated by IMS and based on mapping of IMS identity to GPRS identity. 
[0052] Embodiment 4.). An aspect in this embodiment is to use a new Mapping 
Function. The task of the new Mapping Function is to translate the IMS domain target 
criterion (SIP_URL or TEL_URL) to the corresponding GPRS domain target criterion 
(IMSI, MSISDN, IMEI) associated with the same monitored user (and vice versa). 
The association between IMS domain target criterion and GPRS domain target 
criterion may be static or dynamic. 

[0053] The Mapping Function 4 in ADMF 3 shown in Fig. 1 receives LI information 
related to GPRS domain session (PDP context) from the GSN 12 over the Xl_l 
interface when the GPRS domain session is started (PDP context activated). The 
Mapping Function 4 may receive this LI information either asynchronously without 
querying it, or as a result of an explicit query. The LI information related to GPRS 
domain session consists of GPRS domain session identifiers (e.g. GCID + GGSN 
address, TID) and/or GPRS domain user identities (IMSI, MSISDN, IMEI). 
[0054] The Mapping Function 4 in ADMF 3 receives IMS domain session identifiers 
from the CSCF 1 1 over the Xl l interface when the IMS domain session is started 
(session started with SIP INVITE method). The Mapping Function 4 receives this LI 
information asynchronously without querying it. The LI information related to IMS 
domain session consists of IMS domain session identifiers (e.g. ICID, Call-ID, 
Authorization Token) and GPRS domain session identifiers (e.g. GCID + GGSN 
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address, TID) of the GPRS domain session related to the IMS domain session of the 
monitored user. 

[0055] When the Mapping function 4 receives the LI information from CSCF 1 1 via 
the Xl l interface, it extracts the GPRS domain session identifiers and queries its 
internal cache. 

[0056] If the cache contains binding information which indicates binding between 
GPRS domain session identifier and GPRS domain user identity, related to the GPRS 
domain session identifier received in LI information from CSCF, the ADMF 3 may 
command GSN 12 to start interception of content of communications in GPRS 
domain. If no hit is found in the cache, the Mapping Function 4 of ADMF 3 may 
query the GSNs 12. It includes the GPRS domain session identifier(s) to the query 
message and sends a copy of query message to GSN 12. Query message is sent to all 
SGSNs 21. The Mapping Function 4 of ADMF 3 may choose to send the query 
message to all of the GGSNs 22 or only to the GGSN 22 identified by the GPRS 
domain session identifiers, if the appropriate GGSN 22 is known to ADMF 3. 
[0057] The Mapping Function 4 of ADMF 3 expects to receive GPRS domain user 
identity as a response to the query. When the Mapping Function 4 of ADMF 3 knows 
the GPRS domain user identity related to the IMS domain session associated with the 
monitored user, ADMF 3 may use the known user identity as GPRS domain target 
criterion. 

[0058] Embodiment 5.). This embodiment 5.) is similar to the embodiment 4.), 
except that the Mapping Function 7 is located in DF2 6, as shown in Fig. 2. In this 
embodiment 5.), the CSCF 11 and GSN 12 send the LI information with needed IDs 
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over the X2 interface to the Mapping Fimction(s) 7. Also the Mapping Function 7 
commands the GSN 12 to start interception of content of communications using the 
X2 interface. 

[0059] In the following several embodiments are described which provide for 
collecting IMS IRI with only one interception activation using GPRS identifiers as 
target criterion. 

[0060] The below described embodiments 6.) to 8.) provide an activation of IMS 
interception initiated by GPRS based on examination of GPRS CC. 
[0061] Embodiment 6.). Before IMS UE 20 can perform e.g. the SIP REGISTER 
method when attached to GPRS, it has to activate at least one PDP context. The SIP 
REGISTER message is then transferred through GPRS network as content of 
communications, CC. When there is an interception activated with GPRS domain 
target criterion (IMSI, MSISDN, IMEI), the DF3 9 receives the data containing the 
SIP message (SIP REGISTER in this case) via X3 interface from GSN 12, e.g. from 
SGSN 21 and/or GGSN 22. DF3 9 then checks whether the data contains SIP header 
and whether the SIP header contains SIP URL or TEL URL. If a URL is found in 
data, the DF3 9 may forward LI information to the Mapping Function 4 of ADMF 3 
via the Xl_3 interface, see Fig. 1. The LI information may contain, depending of the 
intercepted SIP message, following information: GPRS domain target criterion, GPRS 
domain session identifiers, IMS domain user identities, IMS domain session 
identifiers, and/or LIID (Lawfiil Interception identifier) of the interception that found 
the IMS domain information. 
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[0062] The Mapping Function 4 may save the LI information into its intemal cache 
for later use. The Mapping Function 4 of ADMF 3 may command the CSCF 1 1 over 
the Xl_l interface to start interception of IMS IRI using the resolved IMS domain 
user identity as IMS domain target criterion. 

[0063] It is likely that SIP REGISTER message reaches the CSCF 11 before LI 
activation request is triggered by the method described above. Therefore it is essential 
that registration and session status of the user specified by the IMS domain target 
criterion is part of the LI activation response message or is sent with an explicit LI 
notification message to DF2 6. 

[0064] This embodiment 6.) may be implemented using a technique wherein the DF3 
9 or GSN 12 can parse out transport layer and application layer headers and extract 
information from them, such as described in PCT/IB03/05125. The LEMF 1 may be 
provided with IRI data on the LI target. 

[0065] Embodiment 7.). This embodiment is shown in Fig. 3, and is similar to 
embodiment 6.), except that the Mapping Function 10 is located in the DF3 9. Thus 
the Mapping Function 4 of ADMF 3 is not needed. 

[0066] Embodiment 8.). This solution is similar to embodiment 6.), except that the 
network function that performs the content of communication analysis is in the GSN 
12 rather than DF3 9. If GSN 12 finds URL in the SIP header found in content of 
communications, it may forward the LI information to the Mapping Function 4 of 
ADMF 3 (Fig. 1) via the Xl_l interface. The other parts of the functionality of this 
embodiment 8.) are identical to that of embodiment 6.). 
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[0067] The below described embodiments 9.) and 10.) provide an activation of IMS 
interception initiated by GPRS based on mapping of GPRS identity to IMS identity. 
[0068] Embodiment 9.). During the media reservation the media authorization is 
done between GGSN 22 and P-CSCF 23 (or more precisely PDF of P-CSCF). The 
media reservation is shown in Fig. 5. 

[0069] The message flow and structure of Fig. 5 is similar to that of Fig. 4 so that the 
above description of Fig. 4 basically applies. Yet the messages 3., 4., and 6. are 
different in so far as in message 3. of Fig. 5 an additional LI information is sent to P- 
CSCF 23 in the COPS REQ message, and messages 4., 6. of Fig. 5 do not contain the 
LI information. 

[0070] For the media reservation, the UE 20 sends Authorization Token in Activate 
PDP Context Request message 1 of Fig. 5. The SGSN 21 forwards the Authorization 
Token to GGSN 22 in Create PDP Context Request message 2. The Authorization 
Token represents the IMS domain session being created in IMS. 

[0071] If there is an interception activated with GPRS domain target criterion this 
Authorisation Token can be exploited in starting the interception in IMS domain. 
When the GSN 12, or 21 or 22, notices an activation of PDP context related to GPRS 
domain target criterion, it reports the Authorization Token to the Mapping Function 4 
of ADMF 3 over the Xl l interface in a LI information message. LI information may 
consist of GPRS domain target criterion, GPRS domain session identifiers, lawful 
interception parameters, and/or IMS domain session identifiers (=Authorization 
Token). The Mapping Function 4 of ADMF 3 saves the information into an internal 
cache for later use. 
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[0072] If the internal cache already contains binding between Authorization Token 
and IMS domain user identity, the Mapping Function 4 of ADMF 3 may activate IMS 
domain interception in CSCF 11 over the Xl l interface. If no hit is found the 
Mapping Function 4 of ADMF 3 may query the CSCF(s) 1 1 for the IMS domain user 
identity. The Mapping Function 4 sends a query message containing the Authorization 
Token to CSCF(s) 1 1 and expects to receive IMS domain user identity in a response 
message. 

[0073] The Mapping Function 4 in ADMF 3 may receive IMS domain session 
identifiers also asynchronously fi-om the CSCF 11 over the Xl_l interface when the 
IMS domain session is started (session started with SIP INVITE method). The LI 
information related to IMS domain session may consist of IMS domain user identities, 
IMS domain session identifiers (e.g. ICID, Call-ID, Authorization Token) and/or 
GPRS domain session identifiers (e.g. GCID + GGSN address, TID) of the GPRS 
domain session related to the IMS domain session of the monitored user. 
[0074] When the IMS domain user identity is known by Mapping Function 4 of 
ADMF 3, the ADMF 3 may command the CSCF(s) 1 1 to start interception in IMS 
domain. 

[0075] Embodiment 10.) This embodiment is in accordance with Fig. 2, and is similar 
to the embodiment 9.), except that the Mapping Function 7 is located in DF2 6. It is 
the DF2 6 in this case that commands the CSCF 1 1 to start the interception in IMS 
domain. 

[0076] Embodiment 11.). This embodiment provides an activation of IMS 
interception initiated by GPRS based on direct activation (Direct activation based 
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GPRS initiated IMS interception activation solution). This embodiment is simileir to 
embodiment 9.), except that no identifier mapping is done. No Mapping Function is 
thus needed. When ADMF 3 receives LI information from GSN 12 containing IMS 
domain session identifier(s), it uses them directly in IMS domain interception 
activation. That is, when the ADMF 3 receives IMS domain session identifier (e.g. 
Authorization Token) from the GSN 12 over the Xl l interface, it may send LI 
activation to the CSCF 1 1 over the Xl_l interface. The LI information sent to CSCF 
1 1 contains LI parameters (LIID, DF2 address, type of interception) and IMS domain 
session identifier (Authorization Token). 

[0077] The below described embodiments 12.), 13.) provide an activation of IMS 
interception initiated by GPRS based on LI upload over Go interface. 
[0078] Embodiment 12.). When GGSN 22 notices that a PDP context being created 
is monitored it may choose to add notification about LI in the COPS REQ message 
(like in message 3. of Fig. 5). The CSCF 11 or 23 may thus start interception of the 
IMS domain user identity associated with the PDP context (and therefore associated 
with GPRS domain user identity). LI information sent in the COPS REQ message 3. 
consists of LI parameters (LIID, DF2 address, type of interception) and IMS domain 
session identifier(s) (optionally GPRS domain target criterion and/or GPRS domain 
session identifiers). 

[0079] LI information may be carried also in Create PDP Context Request message 2. 
sent by SGSN 21 to GGSN 22. This allows also SGSN 21 to trigger IMS domain IRI 
interception. 
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[0080] Embodiment 13.). This embodiment is similar to embodiment 12.), except that 
the COPS REQ message 3. from GGSN 22 to P-CSCF 23 (PDF) contains only an 
indication of need of interception. LI information sent in COPS REQ message 3. may 
consist of GPRS domain target criterion (IMSI, MSISDN, IMEI). The initial 
interception activation is done by ADMF 3 to all network elements using GPRS 
domain target criterion. In CSCF 1 1 the activation is in semi-active state. When the 
indication to intercept with the specific GPRS domain target criterion is received the 
interception changes its state to fully active. Activation responsibility is with ADMF 
like in embodiment 2.). 

[0081] It should be understood that the above description and the accompanying 
figures are only intended to illusfrate the present invention in a non-restrictive manner. 
Thus, the method and apparatus according to the present invention may also be used in 
other implementations or other cellular or non-cellular networks. As an example, 
instead of a SIP network a network based on another protocol such as H.323 may be 
used. The present invention is also applicable to a combination of e.g. CDMA2000 
and IMS network. The invention may thus vary within the scope of the attached 
claims. 
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